727160 - Intermittent dromaeo_jslib crash [@ js::gc::MarkObjectUnbarriered]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=9321952&tree=Mozilla-Inbound
Rev3 WINNT 6.1 mozilla-inbound talos dromaeo on 2012-02-14 02:22:26 PST for push eedec300aaf0

Crash reason:  EXCEPTION_ACCESS_VIOLATION
Crash address: 0x0

Thread 0 (crashed)
 0  mozjs.dll!js::gc::MarkObjectUnbarriered(JSTracer *,JSObject *,char const *) [jsgcmark.cpp:eedec300aaf0 : 138 + 0x17]
    eip = 0x6d34c88d   esp = 0x0016cd90   ebp = 0x0fee2500   ebx = 0x06730468
    esi = 0x00000000   edi = 0x0016ce90   eax = 0x00000001   ecx = 0x0b099000
    edx = 0x0016ce90   efl = 0x00010246
    Found by: given as instruction pointer in context
 1  mozjs.dll!js::gc::MarkKind(JSTracer *,void *,JSGCTraceKind) [jsgcmark.cpp:eedec300aaf0 : 432 + 0xe]
    eip = 0x6d34d903   esp = 0x0016cd98   ebp = 0x0fee2500
    Found by: stack scanning
 2  mozjs.dll!js::gc::MarkRootRange(JSTracer *,JS::Value const *,JS::Value const *,char const *) [jsgcmark.cpp:eedec300aaf0 : 498 + 0x28]
    eip = 0x6d34da7f   esp = 0x0016cda4   ebp = 0x0016ce90
    Found by: stack scanning
 3  mozjs.dll!js::StackSpace::markFrameSlots(JSTracer *,js::StackFrame *,JS::Value *,unsigned char *) [Stack.cpp:eedec300aaf0 : 493 + 0x14]
    eip = 0x6d3daaf9   esp = 0x0016cdc8   ebp = 0x0016ce90
    Found by: stack scanning
 4  mozjs.dll!js::StackFrame::prevpcSlow(js::mjit::CallSite * *) [Stack.cpp:eedec300aaf0 : 222 + 0xc]
    eip = 0x6d3da97f   esp = 0x0016cdf0   ebp = 0x0016ce90
    Found by: stack scanning
 5  mozjs.dll!js::StackSpace::mark(JSTracer *) [Stack.cpp:eedec300aaf0 : 521 + 0xc]
    eip = 0x6d3daf7d   esp = 0x0016cdf8   ebp = 0x0016ce90
    Found by: stack scanning
 6  mozjs.dll!js::MarkRuntime [jsgc.cpp:eedec300aaf0 : 2084 + 0x8]
    eip = 0x6d34950b   esp = 0x0016ce20   ebp = 0x0016ce90
    Found by: stack scanning
 7  mozjs.dll!BeginMarkPhase [jsgc.cpp:eedec300aaf0 : 2651 + 0x9]
    eip = 0x6d349703   esp = 0x0016ce4c   ebp = 0x0016ce90
    Found by: stack scanning
 8  mozjs.dll!MarkAndSweep [jsgc.cpp:eedec300aaf0 : 2830 + 0x12]
    eip = 0x6d34bad2   esp = 0x0016ce64   ebp = 0x0016ce90
    Found by: stack scanning

Comment 1

[Ed Morley [:emorley]]

Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500